# Comfast cf-e391ax

**URL:** <https://forum.openwrt.org/t/comfast-cf-e391ax/248404>\
**Category:** For Developers\
**Created:** [March 29, 2026, 5:27pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404 "2026-03-29T17:27:46Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [March 29, 2026, 5:27pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/1 "2026-03-29T17:27:46Z")

</div>

Hi everyone,

I received a few days ago a COMFAST CF-E391AX AP. I've been using OpenWrt for a few years, but I have never ported it to a new device, and I’m not sure whether I am on the right track.  
I am worried about missing something that could lead me to brick my device. I would be grateful if someone more experienced than I am could help me solve this challenge.

Here is an overview of what I've done so far:

# Hardware

E391AX is close to the supported E393AX but with a different hardware. It has 256MB RAM, 128MB flash, 2 ethernets (1G and 2.5G, both being POE ports), WiFI 6 support with 4 antennas.  
Specification says: MT7981BA + MT7976CN + GPY211 + YT8531SC-CA

> **/proc/cpuinfo**
>
> ```bash
> processor	: 0
> model name	: ARMv8 Processor rev 4 (v8l)
> BogoMIPS	: 26.00
> Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
> CPU implementer	: 0x41
> CPU architecture: 8
> CPU variant	: 0x0
> CPU part	: 0xd03
> CPU revision	: 4
> 
> processor	: 1
> model name	: ARMv8 Processor rev 4 (v8l)
> BogoMIPS	: 26.00
> Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
> CPU implementer	: 0x41
> CPU architecture: 8
> CPU variant	: 0x0
> CPU part	: 0xd03
> CPU revision	: 4
> 
> ```

> **/proc/device-tree/compatible**
>
> ```bash
> comfast,cf-e391axmediatek,mt7981-spim-snand-2500wan-rfb
> 
> ```

> **free -h**
>
> ```bash
> total used free shared buff/cache available
> Mem: 231040 95564 119492 180 15984 121552
> 
> ```

> **cat /proc/mtd**
>
> ```bash
> dev: size erasesize name
> mtd0: 08000000 00020000 "spi0.0"
> mtd1: 00100000 00020000 "BL2"
> mtd2: 00080000 00020000 "u-boot-env"
> mtd3: 00200000 00020000 "Factory"
> mtd4: 00200000 00020000 "FIP"
> mtd5: 04000000 00020000 "ubi"
> 
> ```

# Software

I have rooted the AP using the method described [here](https://git.openwrt.org/openwrt/openwrt/commit/?id=9ac1523062a5818e566627ad4cbea6f3f5114387).  
The OS is an old tweaked OpenWrt.

> **cat /etc/openwrt\_release**
>
> ```bash
> DISTRIB_ID='OpenWrt'
> DISTRIB_RELEASE='21.02-SNAPSHOT'
> DISTRIB_REVISION='r0-db9b53a'
> DISTRIB_TARGET='mediatek/mt7981'
> DISTRIB_ARCH='aarch64_cortex-a53'
> DISTRIB_DESCRIPTION='OpenWrt 21.02-SNAPSHOT r0-db9b53a'
> DISTRIB_TAINTS='no-all busybox'
> 
> ```

I have copied the 5 MTD and extracted the DTS.

> **DTS**
>
> ```plaintext
> /dts-v1/;
> 
> / {
> compatible = "comfast,cf-e391ax", "mediatek,mt7981-spim-snand-2500wan-rfb";
> interrupt-parent = <0x01>;
> #address-cells = <0x02>;
> #size-cells = <0x02>;
> model = "COMFAST CF-E391AX";
> 
> cpus {
> #address-cells = <0x01>;
> #size-cells = <0x00>;
> 
> cpu@0 {
> device_type = "cpu";
> compatible = "arm,cortex-a53";
> enable-method = "psci";
> reg = <0x00>;
> };
> 
> cpu@1 {
> device_type = "cpu";
> compatible = "arm,cortex-a53";
> enable-method = "psci";
> reg = <0x01>;
> };
> };
> 
> pwm@10048000 {
> compatible = "mediatek,mt7981-pwm";
> reg = <0x00 0x10048000 0x00 0x1000>;
> #pwm-cells = <0x02>;
> clocks = <0x02 0x0d 0x02 0x0c 0x02 0x0e 0x02 0x0f 0x02 0x10>;
> clock-names = "top", "main", "pwm1", "pwm2", "pwm3";
> };
> 
> thermal-zones {
> 
> cpu-thermal {
> polling-delay-passive = <0x3e8>;
> polling-delay = <0x3e8>;
> thermal-sensors = <0x03 0x00>;
> };
> };
> 
> thermal@1100c800 {
> #thermal-sensor-cells = <0x01>;
> compatible = "mediatek,mt7981-thermal";
> reg = <0x00 0x1100c800 0x00 0x800>;
> interrupts = <0x00 0x8a 0x04>;
> clocks = <0x02 0x1c 0x02 0x2f 0x02 0x30>;
> clock-names = "therm", "auxadc", "adc_32k";
> mediatek,auxadc = <0x04>;
> mediatek,apmixedsys = <0x05>;
> nvmem-cells = <0x06>;
> nvmem-cell-names = "calibration-data";
> phandle = <0x03>;
> };
> 
> adc@1100d000 {
> compatible = "mediatek,mt7981-auxadc", "mediatek,mt7622-auxadc";
> reg = <0x00 0x1100d000 0x00 0x1000>;
> clocks = <0x02 0x2f 0x02 0x30>;
> clock-names = "main", "32k";
> #io-channel-cells = <0x01>;
> phandle = <0x04>;
> };
> 
> wed@15010000 {
> compatible = "mediatek,wed";
> wed_num = <0x02>;
> pci_slot_map = <0x00 0x01>;
> reg = <0x00 0x15010000 0x00 0x1000 0x00 0x15011000 0x00 0x1000>;
> interrupt-parent = <0x01>;
> interrupts = <0x00 0xcd 0x04 0x00 0xce 0x04>;
> dy_txbm_enable = "true";
> dy_txbm_budget = <0x08>;
> txbm_init_sz = <0x08>;
> txbm_max_sz = <0x20>;
> status = "okay";
> };
> 
> wdma@15104800 {
> compatible = "mediatek,wed-wdma";
> reg = <0x00 0x15104800 0x00 0x400 0x00 0x15104c00 0x00 0x400>;
> };
> 
> ap2woccif@151A5000 {
> compatible = "mediatek,ap2woccif";
> reg = <0x00 0x151a5000 0x00 0x1000 0x00 0x151ad000 0x00 0x1000>;
> interrupt-parent = <0x01>;
> interrupts = <0x00 0xd3 0x04 0x00 0xd4 0x04>;
> };
> 
> wocpu0_ilm@151E0000 {
> compatible = "mediatek,wocpu0_ilm";
> reg = <0x00 0x151e0000 0x00 0x8000>;
> };
> 
> wocpu_dlm@151E8000 {
> compatible = "mediatek,wocpu_dlm";
> reg = <0x00 0x151e8000 0x00 0x2000 0x00 0x151f8000 0x00 0x2000>;
> resets = <0x07 0x00>;
> reset-names = "wocpu_rst";
> };
> 
> wocpu_boot@15194000 {
> compatible = "mediatek,wocpu_boot";
> reg = <0x00 0x15194000 0x00 0x1000>;
> };
> 
> reserved-memory {
> #address-cells = <0x02>;
> #size-cells = <0x02>;
> ranges;
> 
> secmon@43000000 {
> reg = <0x00 0x43000000 0x00 0x30000>;
> no-map;
> };
> 
> wmcpu-reserved@47C80000 {
> compatible = "mediatek,wmcpu-reserved";
> no-map;
> reg = <0x00 0x47c80000 0x00 0x100000>;
> phandle = <0x15>;
> };
> 
> wocpu0_emi@47D80000 {
> compatible = "mediatek,wocpu0_emi";
> no-map;
> reg = <0x00 0x47d80000 0x00 0x40000>;
> shared = <0x00>;
> };
> 
> wocpu_data@47DC0000 {
> compatible = "mediatek,wocpu_data";
> no-map;
> reg = <0x00 0x47dc0000 0x00 0x240000>;
> shared = <0x01>;
> };
> };
> 
> psci {
> compatible = "arm,psci-0.2";
> method = "smc";
> };
> 
> oscillator@0 {
> compatible = "fixed-clock";
> #clock-cells = <0x00>;
> clock-frequency = <0x2625a00>;
> clock-output-names = "clkxtal";
> phandle = <0x1b>;
> };
> 
> infracfg_ao@10001000 {
> compatible = "mediatek,mt7981-infracfg_ao", "syscon";
> reg = <0x00 0x10001000 0x00 0x68>;
> #clock-cells = <0x01>;
> phandle = <0x02>;
> };
> 
> infracfg@10001040 {
> compatible = "mediatek,mt7981-infracfg", "syscon";
> reg = <0x00 0x10001068 0x00 0x1000>;
> #clock-cells = <0x01>;
> phandle = <0x09>;
> };
> 
> topckgen@1001B000 {
> compatible = "mediatek,mt7981-topckgen", "syscon";
> reg = <0x00 0x1001b000 0x00 0x1000>;
> #clock-cells = <0x01>;
> phandle = <0x08>;
> };
> 
> apmixedsys@1001E000 {
> compatible = "mediatek,mt7981-apmixedsys", "syscon";
> reg = <0x00 0x1001e000 0x00 0x1000>;
> #clock-cells = <0x01>;
> phandle = <0x05>;
> };
> 
> dummy_system_clk {
> compatible = "fixed-clock";
> clock-frequency = <0x2625a00>;
> #clock-cells = <0x00>;
> phandle = <0x17>;
> };
> 
> dummy_gpt_clk {
> compatible = "fixed-clock";
> clock-frequency = <0x1312d00>;
> #clock-cells = <0x00>;
> };
> 
> timer {
> compatible = "arm,armv8-timer";
> interrupt-parent = <0x01>;
> clock-frequency = <0xc65d40>;
> interrupts = <0x01 0x0d 0x08 0x01 0x0e 0x08 0x01 0x0b 0x08 0x01 0x0a 0x08>;
> };
> 
> watchdog@1001c000 {
> compatible = "mediatek,mt7622-wdt", "mediatek,mt6589-wdt";
> reg = <0x00 0x1001c000 0x00 0x1000>;
> interrupts = <0x00 0x6e 0x04>;
> #reset-cells = <0x01>;
> status = "okay";
> };
> 
> interrupt-controller@c000000 {
> compatible = "arm,gic-v3";
> #interrupt-cells = <0x03>;
> interrupt-parent = <0x01>;
> interrupt-controller;
> reg = <0x00 0xc000000 0x00 0x40000 0x00 0xc080000 0x00 0x200000>;
> interrupts = <0x01 0x09 0x04>;
> phandle = <0x01>;
> };
> 
> trng@1020f000 {
> compatible = "mediatek,mt7981-rng";
> };
> 
> serial@11002000 {
> compatible = "mediatek,mt6577-uart";
> reg = <0x00 0x11002000 0x00 0x400>;
> interrupts = <0x00 0x7b 0x04>;
> clocks = <0x02 0x1e>;
> assigned-clocks = <0x08 0x50 0x02 0x00>;
> assigned-clock-parents = <0x08 0x00 0x09 0x01>;
> status = "okay";
> };
> 
> serial@11003000 {
> compatible = "mediatek,mt6577-uart";
> reg = <0x00 0x11003000 0x00 0x400>;
> interrupts = <0x00 0x7c 0x04>;
> clocks = <0x02 0x1f>;
> assigned-clocks = <0x08 0x50 0x02 0x01>;
> assigned-clock-parents = <0x08 0x00 0x09 0x01>;
> status = "disabled";
> };
> 
> serial@11004000 {
> compatible = "mediatek,mt6577-uart";
> reg = <0x00 0x11004000 0x00 0x400>;
> interrupts = <0x00 0x7d 0x04>;
> clocks = <0x02 0x20>;
> assigned-clocks = <0x08 0x50 0x02 0x02>;
> assigned-clock-parents = <0x08 0x00 0x09 0x01>;
> status = "disabled";
> };
> 
> i2c@11007000 {
> compatible = "mediatek,mt7981-i2c";
> reg = <0x00 0x11007000 0x00 0x1000 0x00 0x10217080 0x00 0x80>;
> interrupts = <0x00 0x88 0x04>;
> clock-div = <0x01>;
> clocks = <0x02 0x1d 0x02 0x19>;
> clock-names = "main", "dma";
> #address-cells = <0x01>;
> #size-cells = <0x00>;
> status = "disabled";
> };
> 
> pcie@11280000 {
> compatible = "mediatek,mt7981-pcie", "mediatek,mt7986-pcie";
> device_type = "pci";
> reg = <0x00 0x11280000 0x00 0x4000>;
> reg-names = "pcie-mac";
> #address-cells = <0x03>;
> #size-cells = <0x02>;
> interrupts = <0x00 0xa8 0x04>;
> bus-range = <0x00 0xff>;
> ranges = <0x82000000 0x00 0x20000000 0x00 0x20000000 0x00 0x10000000>;
> status = "disabled";
> clocks = <0x02 0x38 0x02 0x39 0x02 0x3a 0x02 0x3b>;
> phys = <0x0a 0x02>;
> phy-names = "pcie-phy";
> #interrupt-cells = <0x01>;
> interrupt-map-mask = <0x00 0x00 0x00 0x07>;
> interrupt-map = <0x00 0x00 0x00 0x01 0x0b 0x00 0x00 0x00 0x00 0x02 0x0b 0x01 0x00 0x00 0x00 0x03 0x0b 0x02 0x00 0x00 0x00 0x04 0x0b 0x03>;
> 
> interrupt-controller {
> interrupt-controller;
> #address-cells = <0x00>;
> #interrupt-cells = <0x01>;
> phandle = <0x0b>;
> };
> };
> 
> crypto@10320000 {
> compatible = "inside-secure,safexcel-eip97";
> reg = <0x00 0x10320000 0x00 0x40000>;
> interrupts = <0x00 0x74 0x04 0x00 0x75 0x04 0x00 0x76 0x04 0x00 0x77 0x04>;
> interrupt-names = "ring0", "ring1", "ring2", "ring3";
> clocks = <0x08 0x42>;
> clock-names = "top_eip97_ck";
> assigned-clocks = <0x08 0x63>;
> assigned-clock-parents = <0x08 0x15>;
> };
> 
> pinctrl@11d00000 {
> compatible = "mediatek,mt7981-pinctrl";
> reg = <0x00 0x11d00000 0x00 0x1000 0x00 0x11c00000 0x00 0x1000 0x00 0x11c10000 0x00 0x1000 0x00 0x11d20000 0x00 0x1000 0x00 0x11e00000 0x00 0x1000 0x00 0x11e20000 0x00 0x1000 0x00 0x11f00000 0x00 0x1000 0x00 0x11f10000 0x00 0x1000 0x00 0x1000b000 0x00 0x1000>;
> reg-names = "gpio_base", "iocfg_rt_base", "iocfg_rm_base", "iocfg_rb_base", "iocfg_lb_base", "iocfg_bl_base", "iocfg_tm_base", "iocfg_tl_base", "eint";
> gpio-controller;
> #gpio-cells = <0x02>;
> gpio-ranges = <0x0c 0x00 0x00 0x38>;
> interrupt-controller;
> interrupts = <0x00 0xe1 0x04>;
> interrupt-parent = <0x01>;
> #interrupt-cells = <0x02>;
> phandle = <0x0c>;
> 
> i2c-pins-g0 {
> 
> mux {
> function = "i2c";
> groups = "i2c0_0";
> };
> };
> 
> pcm-pins-g0 {
> 
> mux {
> function = "pcm";
> groups = "pcm";
> };
> };
> 
> pwm0-pin-g0 {
> 
> mux {
> function = "pwm";
> groups = "pwm0_0";
> };
> };
> 
> pwm1-pin-g0 {
> 
> mux {
> function = "pwm";
> groups = "pwm1_0";
> };
> };
> 
> pwm2-pin {
> 
> mux {
> function = "pwm";
> groups = "pwm2";
> };
> };
> 
> spi0-pins {
> phandle = <0x13>;
> 
> mux {
> function = "spi";
> groups = "spi0", "spi0_wp_hold";
> };
> 
> conf-pu {
> pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
> drive-strength = <0x08>;
> bias-pull-up = <0x67>;
> };
> 
> conf-pd {
> pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
> drive-strength = <0x08>;
> bias-pull-down = <0x67>;
> };
> };
> 
> spi1-pins {
> phandle = <0x14>;
> 
> mux {
> function = "spi";
> groups = "spi1_1";
> };
> };
> 
> uart1-pins-g1 {
> 
> mux {
> function = "uart";
> groups = "uart1_1";
> };
> };
> 
> uart2-pins-g1 {
> 
> mux {
> function = "uart";
> groups = "uart2_1";
> };
> };
> };
> 
> syscon@15000000 {
> #address-cells = <0x01>;
> #size-cells = <0x01>;
> compatible = "mediatek,mt7981-ethsys", "syscon";
> reg = <0x00 0x15000000 0x00 0x1000>;
> #clock-cells = <0x01>;
> #reset-cells = <0x01>;
> phandle = <0x0d>;
> 
> reset-controller {
> compatible = "ti,syscon-reset";
> #reset-cells = <0x01>;
> ti,reset-bits = <0x34 0x04 0x34 0x04 0x34 0x04 0x28>;
> phandle = <0x07>;
> };
> };
> 
> ethernet@15100000 {
> compatible = "mediatek,mt7981-eth";
> reg = <0x00 0x15100000 0x00 0x80000>;
> interrupts = <0x00 0xc4 0x04 0x00 0xc5 0x04 0x00 0xc6 0x04 0x00 0xc7 0x04>;
> clocks = <0x0d 0x00 0x0d 0x01 0x0d 0x02 0x0d 0x03 0x0e 0x00 0x0e 0x01 0x0e 0x02 0x0e 0x03 0x0f 0x00 0x0f 0x01 0x0f 0x02 0x0f 0x03>;
> clock-names = "fe", "gp2", "gp1", "wocpu0", "sgmii_tx250m", "sgmii_rx250m", "sgmii_cdr_ref", "sgmii_cdr_fb", "sgmii2_tx250m", "sgmii2_rx250m", "sgmii2_cdr_ref", "sgmii2_cdr_fb";
> assigned-clocks = <0x08 0x60 0x08 0x61>;
> assigned-clock-parents = <0x08 0x1b 0x08 0x22>;
> mediatek,ethsys = <0x0d>;
> mediatek,sgmiisys = <0x0e 0x0f>;
> mediatek,infracfg = <0x10>;
> #reset-cells = <0x01>;
> #address-cells = <0x01>;
> #size-cells = <0x00>;
> status = "okay";
> 
> mac@0 {
> compatible = "mediatek,eth-mac";
> reg = <0x00>;
> phy-mode = "sgmii";
> phy-handle = <0x11>;
> };
> 
> mac@1 {
> compatible = "mediatek,eth-mac";
> reg = <0x01>;
> phy-mode = "2500base-x";
> phy-handle = <0x12>;
> };
> 
> mdio-bus {
> #address-cells = <0x01>;
> #size-cells = <0x00>;
> 
> phy@5 {
> compatible = "ethernet-phy-id67c9.de10";
> reg = <0x05>;
> reset-gpios = <0x0c 0x0e 0x01>;
> reset-assert-us = <0x258>;
> reset-deassert-us = <0x4e20>;
> phandle = <0x12>;
> };
> 
> phy@3 {
> compatible = "ethernet-phy-id4f51.e91a";
> reg = <0x03>;
> reset-gpios = <0x0c 0x27 0x01>;
> reset-assert-us = <0x2710>;
> reset-deassert-us = <0xc350>;
> phandle = <0x11>;
> };
> };
> };
> 
> hnat@15000000 {
> compatible = "mediatek,mtk-hnat_v4";
> reg = <0x00 0x15100000 0x00 0x80000>;
> resets = <0x0d 0x00>;
> reset-names = "mtketh";
> status = "okay";
> mtketh-wan = "eth1";
> mtketh-lan = "eth0";
> mtketh-max-gmac = <0x02>;
> };
> 
> syscon@10060000 {
> compatible = "mediatek,mt7981-sgmiisys_0", "syscon";
> reg = <0x00 0x10060000 0x00 0x1000>;
> pn_swap;
> #clock-cells = <0x01>;
> phandle = <0x0e>;
> };
> 
> syscon@10070000 {
> compatible = "mediatek,mt7981-sgmiisys_1", "syscon";
> reg = <0x00 0x10070000 0x00 0x1000>;
> #clock-cells = <0x01>;
> phandle = <0x0f>;
> };
> 
> topmisc@11d10000 {
> compatible = "mediatek,mt7981-topmisc", "syscon";
> reg = <0x00 0x11d10000 0x00 0x10000>;
> #clock-cells = <0x01>;
> phandle = <0x10>;
> };
> 
> snfi@11005000 {
> compatible = "mediatek,mt7986-snand";
> reg = <0x00 0x11005000 0x00 0x1000 0x00 0x11006000 0x00 0x1000>;
> reg-names = "nfi", "ecc";
> interrupts = <0x00 0x79 0x04>;
> clocks = <0x02 0x24 0x02 0x23 0x02 0x25>;
> clock-names = "pad_clk", "nfi_clk", "nfi_hclk";
> assigned-clocks = <0x08 0x4d 0x08 0x4c>;
> assigned-clock-parents = <0x08 0x06 0x08 0x06>;
> #address-cells = <0x01>;
> #size-cells = <0x00>;
> status = "disabled";
> };
> 
> mmc@11230000 {
> compatible = "mediatek,mt7986-mmc", "mediatek,mt7981-mmc";
> reg = <0x00 0x11230000 0x00 0x1000 0x00 0x11c20000 0x00 0x1000>;
> interrupts = <0x00 0x8f 0x04>;
> clocks = <0x08 0x33 0x08 0x34 0x02 0x2b>;
> assigned-clocks = <0x08 0x54 0x08 0x55>;
> assigned-clock-parents = <0x08 0x02 0x08 0x1c>;
> clock-names = "source", "hclk", "source_cg";
> status = "disabled";
> };
> 
> wbsys@18000000 {
> compatible = "mediatek,wbsys";
> reg = <0x00 0x18000000 0x00 0x1000000>;
> interrupts = <0x00 0xd5 0x04 0x00 0xd6 0x04 0x00 0xd7 0x04 0x00 0xd8 0x04>;
> chip_id = <0x7981>;
> };
> 
> wed_pcie@10003000 {
> compatible = "mediatek,wed_pcie";
> reg = <0x00 0x10003000 0x00 0x10>;
> };
> 
> spi@1100a000 {
> compatible = "mediatek,ipm-spi-quad";
> reg = <0x00 0x1100a000 0x00 0x100>;
> interrupts = <0x00 0x8c 0x04>;
> clocks = <0x08 0x02 0x08 0x4e 0x02 0x26 0x02 0x28>;
> clock-names = "parent-clk", "sel-clk", "spi-clk", "spi-hclk";
> status = "okay";
> pinctrl-names = "default";
> pinctrl-0 = <0x13>;
> 
> spi_nand@0 {
> #address-cells = <0x01>;
> #size-cells = <0x01>;
> compatible = "spi-nand";
> reg = <0x00>;
> spi-max-frequency = <0x3197500>;
> spi-tx-buswidth = <0x04>;
> spi-rx-buswidth = <0x04>;
> phandle = <0x1c>;
> };
> };
> 
> spi@1100b000 {
> compatible = "mediatek,ipm-spi-single";
> reg = <0x00 0x1100b000 0x00 0x100>;
> interrupts = <0x00 0x8d 0x04>;
> clocks = <0x08 0x02 0x08 0x4f 0x02 0x27 0x02 0x29>;
> clock-names = "parent-clk", "sel-clk", "spi-clk", "spi-hclk";
> status = "disabled";
> pinctrl-names = "default";
> pinctrl-0 = <0x14>;
> };
> 
> spi@11009000 {
> compatible = "mediatek,ipm-spi-quad";
> reg = <0x00 0x11009000 0x00 0x100>;
> interrupts = <0x00 0x8e 0x04>;
> clocks = <0x08 0x02 0x08 0x4e 0x02 0x21 0x02 0x22>;
> clock-names = "parent-clk", "sel-clk", "spi-clk", "spi-hclk";
> status = "disabled";
> };
> 
> consys@10000000 {
> compatible = "mediatek,mt7981-consys";
> reg = <0x00 0x10000000 0x00 0x8600000>;
> memory-region = <0x15>;
> };
> 
> xhci@11200000 {
> compatible = "mediatek,mt7986-xhci", "mediatek,mtk-xhci";
> reg = <0x00 0x11200000 0x00 0x2e00 0x00 0x11203e00 0x00 0x100>;
> reg-names = "mac", "ippc";
> interrupts = <0x00 0xad 0x04>;
> phys = <0x16 0x03 0x0a 0x04>;
> clocks = <0x17 0x17 0x17 0x17 0x17>;
> clock-names = "sys_ck", "xhci_ck", "ref_ck", "mcu_ck", "dma_ck";
> #address-cells = <0x02>;
> #size-cells = <0x02>;
> mediatek,u3p-dis-msk = <0x00>;
> status = "okay";
> };
> 
> usb-phy@11e10000 {
> compatible = "mediatek,mt7986", "mediatek,generic-tphy-v2";
> #address-cells = <0x02>;
> #size-cells = <0x02>;
> ranges;
> status = "okay";
> 
> usb-phy@11e10000 {
> reg = <0x00 0x11e10000 0x00 0x700>;
> clocks = <0x17>;
> clock-names = "ref";
> #phy-cells = <0x01>;
> status = "okay";
> phandle = <0x16>;
> };
> 
> usb-phy@11e10700 {
> reg = <0x00 0x11e10700 0x00 0x900>;
> clocks = <0x17>;
> clock-names = "ref";
> #phy-cells = <0x01>;
> mediatek,syscon-type = <0x10 0x218 0x00>;
> nvmem-cells = <0x18 0x19 0x1a>;
> nvmem-cell-names = "intr", "rx_imp", "tx_imp";
> status = "okay";
> phandle = <0x0a>;
> };
> };
> 
> regulator-3p3v {
> compatible = "regulator-fixed";
> regulator-name = "fixed-3.3V";
> regulator-min-microvolt = <0x325aa0>;
> regulator-max-microvolt = <0x325aa0>;
> regulator-boot-on;
> regulator-always-on;
> };
> 
> clkitg {
> compatible = "simple-bus";
> 
> bring-up {
> compatible = "mediatek,clk-bring-up";
> clocks = <0x05 0x00 0x05 0x01 0x05 0x02 0x05 0x03 0x05 0x04 0x05 0x05 0x05 0x06 0x05 0x07 0x09 0x00 0x1b 0x09 0x02 0x09 0x03 0x09 0x04 0x1b 0x09 0x06 0x09 0x07 0x1b 0x1b 0x1b 0x1b 0x09 0x0c 0x09 0x0d 0x09 0x0e 0x09 0x0f 0x09 0x10 0x09 0x11 0x1b 0x1b 0x1b 0x1b 0x1b 0x09 0x17 0x09 0x18 0x09 0x1a 0x09 0x1b 0x09 0x1c 0x09 0x1d 0x09 0x1e 0x09 0x1f 0x09 0x20 0x09 0x21 0x1b 0x09 0x23 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x0b 0x1b 0x1b 0x1b 0x1b 0x02 0x11 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x17 0x1b 0x02 0x19 0x02 0x1a 0x02 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x1b 0x02 0x2a 0x02 0x2b 0x02 0x2c 0x02 0x2d 0x02 0x2e 0x1b 0x1b 0x02 0x31 0x02 0x32 0x02 0x33 0x02 0x34 0x02 0x35 0x02 0x36 0x02 0x37 0x1b 0x1b 0x1b 0x08 0x01 0x1b 0x08 0x05 0x08 0x06 0x08 0x07 0x08 0x04 0x08 0x09 0x08 0x0c 0x08 0x0f 0x08 0x10 0x08 0x12 0x08 0x14 0x08 0x15 0x08 0x16 0x08 0x17 0x08 0x19 0x08 0x1a 0x1b 0x08 0x1d 0x08 0x1e 0x08 0x21 0x1b 0x08 0x24 0x08 0x25 0x1b 0x08 0x29 0x08 0x26 0x08 0x2b 0x08 0x2a 0x1b 0x08 0x31 0x1b 0x1b 0x1b 0x08 0x56 0x08 0x37 0x08 0x3d 0x08 0x3e 0x08 0x3f 0x08 0x45 0x08 0x41 0x08 0x46 0x08 0x47 0x08 0x48 0x08 0x49 0x08 0x4a 0x08 0x3a 0x1b 0x1b 0x1b 0x1b 0x08 0x52 0x1b 0x1b 0x1b 0x08 0x56 0x08 0x57 0x08 0x58 0x08 0x59 0x08 0x5a 0x08 0x5b 0x08 0x5c 0x08 0x5d 0x08 0x5e 0x08 0x5f 0x1b 0x1b 0x08 0x62 0x08 0x5e 0x1b 0x08 0x64 0x08 0x56 0x08 0x69 0x08 0x6a 0x08 0x6b 0x08 0x6c>;
> clock-names = "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "100", "101", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "132", "133", "134", "135", "136", "137", "138", "139", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "169", "170", "171", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183";
> };
> };
> 
> efuse@11f20000 {
> compatible = "mediatek,efuse";
> reg = <0x00 0x11f20000 0x00 0x1000>;
> #address-cells = <0x01>;
> #size-cells = <0x01>;
> 
> calib@274 {
> reg = <0x274 0x0c>;
> phandle = <0x06>;
> };
> 
> calib@8dc {
> reg = <0x8dc 0x10>;
> };
> 
> usb3-rx-imp@8c8 {
> reg = <0x8c8 0x01>;
> bits = <0x00 0x05>;
> phandle = <0x19>;
> };
> 
> usb3-tx-imp@8c8 {
> reg = <0x8c8 0x02>;
> bits = <0x05 0x05>;
> phandle = <0x1a>;
> };
> 
> usb3-intr@8c9 {
> reg = <0x8c9 0x01>;
> bits = <0x02 0x06>;
> phandle = <0x18>;
> };
> };
> 
> audio-controller@11210000 {
> compatible = "mediatek,mt79xx-audio";
> reg = <0x00 0x11210000 0x00 0x9000>;
> interrupts = <0x00 0x6a 0x04>;
> clocks = <0x02 0x12 0x02 0x13 0x02 0x14 0x02 0x15 0x02 0x16 0x08 0x65>;
> clock-names = "aud_bus_ck", "aud_26m_ck", "aud_l_ck", "aud_aud_ck", "aud_eg2_ck", "aud_sel";
> assigned-clocks = <0x08 0x65 0x08 0x66 0x08 0x67 0x08 0x68>;
> assigned-clock-parents = <0x08 0x10 0x08 0x12 0x08 0x10 0x08 0x12>;
> status = "disabled";
> };
> 
> ice_debug {
> compatible = "mediatek,mt7981-ice_debug", "mediatek,mt2701-ice_debug";
> clocks = <0x02 0x18>;
> clock-names = "ice_dbg";
> };
> 
> chosen {
> u-boot,bootconf = "config-1";
> u-boot,version = "2023.10-rc4";
> bootargs = "console=ttyS0,115200n1 loglevel=8 \t\t\t\tearlycon=uart8250,mmio32,0x11002000";
> };
> 
> memory {
> device_type = "memory";
> reg = <0x00 0x40000000 0x00 0x10000000>;
> };
> 
> nmbm_spim_nand {
> compatible = "generic,nmbm";
> #address-cells = <0x01>;
> #size-cells = <0x01>;
> lower-mtd-device = <0x1c>;
> forced-create;
> 
> partitions {
> compatible = "fixed-partitions";
> #address-cells = <0x01>;
> #size-cells = <0x01>;
> 
> partition@0 {
> label = "BL2";
> reg = <0x00 0x100000>;
> read-only;
> };
> 
> partition@100000 {
> label = "u-boot-env";
> reg = <0x100000 0x80000>;
> };
> 
> partition@180000 {
> label = "Factory";
> reg = <0x180000 0x200000>;
> };
> 
> partition@380000 {
> label = "FIP";
> reg = <0x380000 0x200000>;
> };
> 
> partition@580000 {
> label = "ubi";
> reg = <0x580000 0x4000000>;
> };
> };
> };
> 
> gpio-leds {
> compatible = "gpio-leds";
> 
> red_led {
> label = "comfast:red:led";
> gpios = <0x0c 0x22 0x01>;
> };
> 
> green_led {
> label = "comfast:green:led";
> gpios = <0x0c 0x23 0x01>;
> };
> 
> blue_led {
> label = "comfast:blue:led";
> gpios = <0x0c 0x08 0x01>;
> };
> };
> 
> gpio-keys {
> compatible = "gpio-keys";
> 
> wps {
> label = "wps";
> linux,code = <0x211>;
> gpios = <0x0c 0x00 0x01>;
> };
> 
> reset {
> label = "reset";
> linux,code = <0x198>;
> gpios = <0x0c 0x01 0x01>;
> };
> };
> };
> 
> ```

I have added the DTS in the device tree (in `openwrt/target/linux/mediatek/dts` ) and added an entry in the makefile (`openwrt/target/linux/mediatek/image/filogic.mk`).

> **filogic.mk**
>
> ```Makefile
> define Device/comfast_cf-e391ax
> DEVICE_VENDOR := COMFAST
> DEVICE_MODEL := CF-E391AX
> DEVICE_DTS := mt7981ba-comfast-cf-e391ax
> DEVICE_DTS_DIR := ../dts
> DEVICE_DTC_FLAGS := --pad 4096
> DEVICE_DTS_LOADADDR := 0x43f00000
> DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
> KERNEL_LOADADDR := 0x44000000
> KERNEL = kernel-bin | lzma | \
> fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
> KERNEL_INITRAMFS = kernel-bin | lzma | \
> fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
> UBINIZE_OPTS := -E 5
> BLOCKSIZE := 128k
> PAGESIZE := 2048
> IMAGE_SIZE := 65536k
> KERNEL_IN_UBI := 1
> IMAGES := sysupgrade.bin factory.bin
> IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
> IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
> endef
> TARGET_DEVICES += comfast_cf-e391ax
> 
> ```

Based on [theses instructions](https://openwrt.org/docs/guide-developer/toolchain/use-buildsystem#official_config), I have created a custom `.config` file and I'm currently trying to build an image (struggling with my podman instance at the moment).

> **.config**
>
> ```bash
> CONFIG_TARGET_mediatek=y
> CONFIG_TARGET_mediatek_filogic=y
> CONFIG_TARGET_MULTI_PROFILE=y
> CONFIG_TARGET_DEVICE_mediatek_filogic_DEVICE_comfast_cf-e391ax=y
> CONFIG_TARGET_DEVICE_PACKAGES_mediatek_filogic_DEVICE_comfast_cf-e391ax="
> CONFIG_ALL_KMODS=y
> CONFIG_ALL_NONSHARED=y
> CONFIG_DEVEL=y
> CONFIG_TARGET_PER_DEVICE_ROOTFS=y
> CONFIG_AUTOREMOVE=y
> CONFIG_BUILDBOT=y
> CONFIG_COLLECT_KERNEL_DEBUG=y
> CONFIG_IB=y
> CONFIG_IMAGEOPT=y
> CONFIG_JSON_CYCLONEDX_SBOM=y
> CONFIG_KERNEL_BUILD_DOMAIN="buildhost"
> CONFIG_KERNEL_BUILD_USER="builder"
> # CONFIG_KERNEL_KALLSYMS is not set
> CONFIG_MAKE_TOOLCHAIN=y
> CONFIG_PACKAGE_attendedsysupgrade-common=y
> CONFIG_PACKAGE_cgi-io=y
> CONFIG_PACKAGE_libiwinfo=y
> CONFIG_PACKAGE_libiwinfo-data=y
> CONFIG_PACKAGE_liblucihttp=y
> CONFIG_PACKAGE_liblucihttp-ucode=y
> CONFIG_PACKAGE_luci=y
> CONFIG_PACKAGE_luci-app-attendedsysupgrade=y
> CONFIG_PACKAGE_luci-app-firewall=y
> CONFIG_PACKAGE_luci-app-package-manager=y
> CONFIG_PACKAGE_luci-base=y
> CONFIG_PACKAGE_luci-lib-uqr=y
> CONFIG_PACKAGE_luci-light=y
> CONFIG_PACKAGE_luci-mod-admin-full=y
> CONFIG_PACKAGE_luci-mod-network=y
> CONFIG_PACKAGE_luci-mod-status=y
> CONFIG_PACKAGE_luci-mod-system=y
> CONFIG_PACKAGE_luci-proto-ipv6=y
> CONFIG_PACKAGE_luci-proto-ppp=y
> CONFIG_PACKAGE_luci-ssl=y
> CONFIG_PACKAGE_luci-theme-bootstrap=y
> CONFIG_PACKAGE_owut=y
> CONFIG_PACKAGE_px5g-mbedtls=y
> CONFIG_PACKAGE_rpcd=y
> CONFIG_PACKAGE_rpcd-mod-file=y
> CONFIG_PACKAGE_rpcd-mod-iwinfo=y
> CONFIG_PACKAGE_rpcd-mod-luci=y
> CONFIG_PACKAGE_rpcd-mod-rpcsys=y
> CONFIG_PACKAGE_rpcd-mod-rrdns=y
> CONFIG_PACKAGE_rpcd-mod-ucode=y
> CONFIG_PACKAGE_ucode-mod-html=y
> CONFIG_PACKAGE_ucode-mod-log=y
> CONFIG_PACKAGE_ucode-mod-math=y
> CONFIG_PACKAGE_ucode-mod-uclient=y
> CONFIG_PACKAGE_uhttpd=y
> CONFIG_PACKAGE_uhttpd-mod-ubus=y
> CONFIG_REPRODUCIBLE_DEBUG_INFO=y
> CONFIG_SDK=y
> CONFIG_SDK_LLVM_BPF=y
> CONFIG_TARGET_ALL_PROFILES=y
> CONFIG_VERSIONOPT=y
> CONFIG_VERSION_BUG_URL=""
> CONFIG_VERSION_CODE=""
> CONFIG_VERSION_DIST="OpenWrt"
> CONFIG_VERSION_FILENAMES=y
> CONFIG_VERSION_FIRMWARE_URL=""
> CONFIG_VERSION_HOME_URL=""
> CONFIG_VERSION_HWREV=""
> CONFIG_VERSION_MANUFACTURER=""
> CONFIG_VERSION_MANUFACTURER_URL=""
> CONFIG_VERSION_NUMBER=""
> CONFIG_VERSION_PRODUCT=""
> CONFIG_VERSION_REPO="https://downloads.openwrt.org/releases/25.12.2"
> CONFIG_VERSION_SUPPORT_URL=""
> 
> ```

# Questions

- is the `.config` file ok?
- is it alright to use the DTS without any modification?
- is there any way to test the builded image in non destructive way (in memory)?

---

<div class="post-metadata">

**Author:** ![who\_what8](https://forum.openwrt.org/letter_avatar/who_what8/32/5_5575768a8748004e209b776fc1b2916d.png) [@who\_what8](https://forum.openwrt.org/u/who_what8)\
**Post date:** [April 13, 2026, 5:36pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/2 "2026-04-13T17:36:03Z")

</div>

> [@clsergent](#):
>
> is the `.config` file ok?

if in doubt, you can delete your .config file and `make menuconfig` and selecting your device from the menu to ensure it's "clean"

> [@clsergent](#):
>
> is it alright to use the DTS without any modification?

You should not use the factory DTS file without modification, but rather, create a new DTS specifically (or adapt an existing one) for this device. Based on what I'm reading, a good place to start is taking a look at the [Comfast CF-E393AX DTS file](https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/dts/mt7981a-comfast-cf-e393ax.dts). This may "just work", but if not, you can adapt it for your device, likely the changes needed are probably mostly the networking sections, such as `&eth`, `&mdio_bus`, etc.

> [@clsergent](#):
>
> is there any way to test the builded image in non destructive way (in memory)?

Yes, you can set up a TFTP server and use `bootm` (load image into memory) from U-boot console.

For example, this is for the Comfast CF-E593AX (also based on MT7981) which I'm working on and explanation of this one-liner:

```plaintext
setenv serverip 192.168.1.60; setenv ipaddr 192.168.1.1; tftpboot 0x46000000 openwrt-mediatek-filogic-comfast_cf-e593ax-initramfs-kernel.bin; bootm

```

TFTP server to use is `192.168.1.60`. Device IP is set to `192.168.1.1`. Filename is `openwrt-mediatek-filogic-comfast_cf-e593ax-initramfs-kernel.bin` located at the root. You can easily adapt it for your use.

---

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [April 14, 2026, 8:17am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/3 "2026-04-14T08:17:48Z")

</div>

First of all, thank you very much taking time to read and answer my post!

About the `.config` file, I'm really unsure about which values should be selected to make a fully working firmware. Very few values are ticked by default, while the filogik config file used to compile distributed firmwares (such as [this one](https://downloads.openwrt.org/releases/25.12.2/targets/mediatek/filogic/config.buildinfo)) seems to tick almost everything...  
The `.config`file I provided earlier is actually a modification of the filogik one, removing other targets. Is it overkill?

About the DTS, I checked the Comfast CF-E393AX DTS file, which seems quite different from the factory DTS, but it may just be layout. What's wrong about using the factory DTS?

About TFTP, I understand I have to access UART pins, right? Is there any way to enter uboot over IP rather than serial?

---

<div class="post-metadata">

**Author:** ![ElektromAn](https://forum.openwrt.org/user_avatar/forum.openwrt.org/elektroman/32/136671_2.png) [@ElektromAn](https://forum.openwrt.org/u/ElektromAn)\
**Post date:** [April 14, 2026, 8:55am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/4 "2026-04-14T08:55:46Z")

</div>

> [@clsergent](#):
>
> About the `.config` file, I'm really unsure about which values should be selected to make a fully working firmware. Very few values are ticked by default, while the filogik config file used to compile distributed firmwares (such as [this one](https://downloads.openwrt.org/releases/25.12.2/targets/mediatek/filogic/config.buildinfo)) seems to tick almost everything...  
> The `.config`file I provided earlier is actually a modification of the filogik one, removing other targets. Is it overkill?

The best way is a new/clean .config

So you have a minimal set of options for testing.

> [@clsergent](#):
>
> About the DTS, I checked the Comfast CF-E393AX DTS file, which seems quite different from the factory DTS, but it may just be layout. What's wrong about using the factory DTS?

The factory DTS is bloated, outdated or other things.  
The " Comfast CF-E393AX DTS" includes some other files

The resulting DTB may or may not equal to your ventor DTS.  
you can decompile the DTB with dtc (please read the man-page or help)

Some factory DTS may have dts nodes which are not in upstream kernel.

> [@clsergent](#):
>
> About TFTP, I understand I have to access UART pins, right? Is there any way to enter uboot over IP rather than serial?

I don't know the board.  
but serial _is_ essential for for new board support, you need the messeges for error if the kernel does not boot correctly and your ssh/dropbear daemon will not start ...

---

<div class="post-metadata">

**Author:** ![who\_what8](https://forum.openwrt.org/letter_avatar/who_what8/32/5_5575768a8748004e209b776fc1b2916d.png) [@who\_what8](https://forum.openwrt.org/u/who_what8)\
**Post date:** [April 14, 2026, 10:53am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/5 "2026-04-14T10:53:46Z")

</div>

> [@clsergent](#):
>
> About the `.config` file, I'm really unsure about which values should be selected to make a fully working firmware. Very few values are ticked by default, while the filogik config file used to compile distributed firmwares (such as [this one](https://downloads.openwrt.org/releases/25.12.2/targets/mediatek/filogic/config.buildinfo)) seems to tick almost everything...  
> The `.config`file I provided earlier is actually a modification of the filogik one, removing other targets. Is it overkill?

For a clean `.config` file, delete the existing one, run `make menuconfig` and just have the device selected for `Target`, `Subtarget` and `Target Profile`. That'll create a minimal image for your device. This assumes `DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware` is all you need in your `filogic.mk` modifications. Additional package should be added there if other default packages are needed.

> [@clsergent](#):
>
> About the DTS, I checked the Comfast CF-E393AX DTS file, which seems quite different from the factory DTS, but it may just be layout. What's wrong about using the factory DTS?

As noted by @ElektromAn, other files are included in the CF-E393AX DTS file. which greatly reduces the resulting DTS for your device.

> [@clsergent](#):
>
> About TFTP, I understand I have to access UART pins, right? Is there any way to enter uboot over IP rather than serial?

Yes, it is highly probable you will need UART access in order to interrupt the Uboot process and run your own image without writing to the NAND. I will even say definitely needed, and is the only way you can run an image without potential changes to the currently installed firmware.

---

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [April 14, 2026, 5:01pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/6 "2026-04-14T17:01:02Z")

</div>

Alright, I'm creating a brand new DTS following OpenWrt conventions as much as possible, copying as much as possible from cf-e393AX.

I'm already facing differences between the `mt7981b.dtsi` and my stock DTS.  
Indeed, the cf-e391AX has a crypto:

```dts
		compatible = "inside-secure,safexcel-eip97";
		reg = <0x00 0x10320000 0x00 0x40000>;

```

while `mt7981b.dtsi` doesn't seem to have any crypto, which I don't understand because e393AX has a crypto entry:

```plaintext
&crypto {
    status = "okay";
};

```

Where is it described?

---

<div class="post-metadata">

**Author:** ![who\_what8](https://forum.openwrt.org/letter_avatar/who_what8/32/5_5575768a8748004e209b776fc1b2916d.png) [@who\_what8](https://forum.openwrt.org/u/who_what8)\
**Post date:** [April 14, 2026, 6:05pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/7 "2026-04-14T18:05:56Z")

</div>

> [@clsergent](#):
>
> while `mt7981b.dtsi` doesn't seem to have any crypto, which I don't understand because e393AX has a crypto entry:
> 
> ```plaintext
> &crypto {
> status = "okay";
> };
> 
> ```
> 
> Where is it described?

The upstream mt7981b.dtsi file doesn't include `crypto`, but a [patch](https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/patches-6.12/117-complete-mt7981b-dtsi.patch#L111-L123) exists within Openwrt repo to add it.

Personally, rather than keeping track of all the patches, I typically take a look at my `build_dir` on the build host. In this case, the `mt7981b.dtsi` file with all patches applied is located in `./build_dir/target-aarch64_cortex-a53_musl/linux-mediatek_filogic/linux-6.12.80/arch/arm64/boot/dts/mediatek/mt7981b.dtsi` within your build root directory.

---

<div class="post-metadata">

**Author:** ![ElektromAn](https://forum.openwrt.org/user_avatar/forum.openwrt.org/elektroman/32/136671_2.png) [@ElektromAn](https://forum.openwrt.org/u/ElektromAn)\
**Post date:** [April 16, 2026, 6:59am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/8 "2026-04-16T06:59:30Z")

</div>

> [@clsergent](#):
>
> ```plaintext
> &crypto {
> status = "okay";
> };
> 
> ```
> 
> Where is it described?

now it's get messy 😉

the decribed patch form @who_what8 is a modification from "uptream".

The driver is upstream

---

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [April 16, 2026, 7:38am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/9 "2026-04-16T07:38:18Z")

</div>

I followed @who_what8 advice and compiled OpenWrt for cf-e393ax, then retrieved the patched ˋmt7981b.dtsi` file from the build directory.

I created a new DTS including this DTSI, with very little difference with cf-e393ax (mainly Ethernet wiring) and successfully compiled.  
I expect to flash my device today or tomorrow.

---

<div class="post-metadata">

**Author:** ![db260179](https://forum.openwrt.org/user_avatar/forum.openwrt.org/db260179/32/25877_2.png) [@db260179](https://forum.openwrt.org/u/db260179)\
**Post date:** [April 16, 2026, 8:34am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/10 "2026-04-16T08:34:05Z")

</div>

Hi, Comfast are very lazy when adding new devices, so usually its a case of copy and paste an existing comfast, as per the 393ax. then just changing the number.

Tweaking the ethernet and gpio numbers - I did e593ax recently, had a new phy Airoha AN8801SB and no switch.

Make sure to have serial access and boot from the u-boot tftp boot via the initramfs image first - DO NOT blindly upgrade an untested firmware image, best to test your changes to make sure it works first as initramfs doesn’t make any changes to the flash chip!

Hope this helps?

My source code of changes, been doing some mediatek patches (you can get an idea on adding devices based on my commits) - [https://github.com/db260179/openwrt/tree/openwrt-25.12-mtk-stable](https://github.com/db260179/openwrt/tree/openwrt-25.12-mtk-stable)

---

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [April 16, 2026, 10:43am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/11 "2026-04-16T10:43:10Z")

</div>

Crystal clear.  
Just a question about how to access uart pins as I have yet to open my device: I read that on the cf-e393ax one can solder wires on the rear face of the soc to avoid removing the heatsink, is there a picture of this anywhere?

---

<div class="post-metadata">

**Author:** ![db260179](https://forum.openwrt.org/user_avatar/forum.openwrt.org/db260179/32/25877_2.png) [@db260179](https://forum.openwrt.org/u/db260179)\
**Post date:** [April 16, 2026, 10:50am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/12 "2026-04-16T10:50:04Z")

</div>

Time to be brave, each device will have the uart markings of tx,rx,gnd and 5v pins on the board - comfast usually puts them under the heatsink.

You will need to investigate on your device i’m afraid, part of the openwrt hacking.

---

<div class="post-metadata">

**Author:** ![who\_what8](https://forum.openwrt.org/letter_avatar/who_what8/32/5_5575768a8748004e209b776fc1b2916d.png) [@who\_what8](https://forum.openwrt.org/u/who_what8)\
**Post date:** [April 16, 2026, 4:54pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/13 "2026-04-16T16:54:34Z")

</div>

> [@db260179](#):
>
> Tweaking the ethernet and gpio numbers - I did e593ax recently, had a new phy Airoha AN8801SB and no switch.

Did you create a branch for the CF-E593AX? I have a [PR open](https://github.com/openwrt/openwrt/pull/22330) and we can do a comparison.

Let's move the CF-E593AX talk to:

> [@Adding support for Comfast CF-E593AX](https://forum.openwrt.org/t/adding-support-for-comfast-cf-e593ax/247390):
>
> I recently came across a very interesting device, the Comfast CF-E593AX. There's other devices with similar form factor but most have limited storage, such as from manufacturers like TP-Link. I initially thought this would be a relatively painless port to Openwrt, but I didn't realize there was no support for the Airoha AN8801SB to get the LAN port working (as far as I know). Searched the web and found older drivers which still work flawlessly as far as I can tell. With the Generic PH…

> [@clsergent](#):
>
> Just a question about how to access uart pins as I have yet to open my device: I read that on the cf-e393ax one can solder wires on the rear face of the soc to avoid removing the heatsink, is there a picture of this anywhere?

This is for you to find out since you are the only one in this thread with the device. Thankfully, Comfast devices are not difficult to open.

---

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [April 17, 2026, 2:37pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/14 "2026-04-17T14:37:32Z")

</div>

For the record, UART pins are labelled on the board, just had to solder pins. I will upload a picture once I'm done with uboot and DTS.

---

<div class="post-metadata">

**Author:** ![clsergent](https://forum.openwrt.org/letter_avatar/clsergent/32/5_5575768a8748004e209b776fc1b2916d.png) [@clsergent](https://forum.openwrt.org/u/clsergent)\
**Post date:** [April 25, 2026, 10:04am UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/15 "2026-04-25T10:04:25Z")

</div>

I successfully flashed OpenWrt on the AP!  
Thank you to @db260179, @ElektromAn and @who_what8 for helping me solve this challenge.  
Check this [repo](https://github.com/clsergent/openwrt-comfast-cf-e391ax) to compile your firmware.  
I will stress‑test the AP a bit before requesting the merge

 ![LuCI](https://forum.openwrt.org/uploads/default/original/3X/4/a/4af33e5b2e2b858c2ff7b17e81df5caf50d13c44.png)

As I promised earlier, here is a picture of the UART pins, which are not located under the heatsink but still require some soldering:

 ![Pins UART](https://forum.openwrt.org/uploads/default/original/3X/9/c/9c856df4867a8abade57a0e02e3f484c97941d90.jpeg)

---

<div class="post-metadata">

**Author:** ![who\_what8](https://forum.openwrt.org/letter_avatar/who_what8/32/5_5575768a8748004e209b776fc1b2916d.png) [@who\_what8](https://forum.openwrt.org/u/who_what8)\
**Post date:** [April 30, 2026, 12:51pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/16 "2026-04-30T12:51:59Z")

</div>

Congrats! After testing, you should submit a [pull request](https://openwrt.org/submitting-patches) to main.

---

<div class="post-metadata">

**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\
**Post date:** [May 10, 2026, 12:52pm UTC](https://forum.openwrt.org/t/comfast-cf-e391ax/248404/17 "2026-05-10T12:52:27Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.